access to user_id and permissions